Backlog #1731

OpenNebula Sunstone + SimpleSAMLphp integration

Added by Milán Unicsovics over 7 years ago. Updated about 6 years ago.

Status:NewStart date:01/17/2013
Priority:NormalDue date:
Assignee:-% Done:

100%

Category:Sunstone
Target version:-

Description

Hello,

this is a new authentication system for OpenNebula Sunstone, it is designed to work with SimpleSAMLphp, and so the authentication of the users is SAML-federated. On the IDP side you can either use SimpleSAMLphp or other SAML-based software as well. We are using this solution within our institute together with Virtual Organization Management software. Since we have introduced this system user management become much easier.

This authentication system contains an OpenNebula patch, and two standard SimpleSAMLphp modules. The OpenNebula extension part of the patch based on the XML-RPC API, and works together with SimpleSAMLphp SP. When a user authenticated in SimpleSAMLphp, it transfers an attribute, which informs the OpenNebula authentication module about the user's group. This method allows the user to belong to more groups, and its group can be switched at the login.

Features:

  • simplified login with SAML
  • users can belong to more groups

More info at: SSP for OpenNebula homepage

We hope this will be as useful for others as it is for us.
SZTAKI ITAK

ssp_for_opennebula.patch Magnifier - patch for enable SAML-based authentication of Sunstone (29.1 KB) Milán Unicsovics, 01/17/2013 01:26 PM

ssp_for_opennebula4.1.patch Magnifier - patch for enable SAML-based authentication of Sunstone (26.3 KB) Milán Unicsovics, 06/14/2013 01:19 PM

opennebula_4.4_shib.tar.gz (21.3 KB) Milán Unicsovics, 03/05/2014 03:20 PM

History

#1 Updated by Ruben S. Montero over 7 years ago

  • Target version changed from Release 3.8.3 to Release 4.0

#2 Updated by Javi Fontan over 7 years ago

  • Target version deleted (Release 4.0)

We are moving this integration to 4.2 as we think we won't have time to do it. It's not only adding the code to the repo, we also have to create tests for it, integrate other parts that require authentication appart from Sunstone, etc.

Anyway, we think it will be great to have the drivers ready for 4.0 and that could be installed easily on top of it. We can discuss the best method to do it here or by any other means.

Thank you!

#3 Updated by Ruben S. Montero about 7 years ago

  • Tracker changed from Feature to Backlog

#4 Updated by Ruben S. Montero about 7 years ago

  • Status changed from New to Pending

#5 Updated by Milán Unicsovics about 7 years ago

Here is the updated patch for Sunstone + SimpleSAMLphp integration module. It can be applied to OpenNebula 4.1 source code.

Please let us know, if we can help in writing tests or in any other task!

#6 Updated by Daniel Molina over 6 years ago

  • Tracker changed from Backlog to Feature
  • Status changed from Pending to New
  • Assignee set to Daniel Molina
  • Target version set to Release 4.6

Hi Milán Unicsovics,

Sorry for taking to long to consider this patch. Is this the last version of the SAML integration? I will take a look to the code during these days (next week), so if you have any updated version let me know, so we can consider it.

Thank you

#7 Updated by Milán Unicsovics over 6 years ago

Daniel Molina wrote:

Hi Milán Unicsovics,

Sorry for taking to long to consider this patch. Is this the last version of the SAML integration? I will take a look to the code during these days (next week), so if you have any updated version let me know, so we can consider it.

Thank you

Hello,

We are working on an updated version of the OpenNebula SAML integration. It has less software dependency, than the earlier version and integrates better in the OpenNebula environment. In the next weeks we are planning to release it, that's why I recommend to consider that version to merge into OpenNebula. If you have questions or comment please let us know!

#8 Updated by Daniel Molina over 6 years ago

Milán Unicsovics wrote:

We are working on an updated version of the OpenNebula SAML integration. It has less software dependency, than the earlier version and integrates better in the OpenNebula environment. In the next weeks we are planning to release it, that's why I recommend to consider that version to merge into OpenNebula. If you have questions or comment please let us know!

Great! It would be great to have it in the next weeks, before the end of the month.

#9 Updated by Jaime Melis over 6 years ago

  • Target version changed from Release 4.6 to Release 4.8

#10 Updated by Milán Unicsovics over 6 years ago

Hello!

I think the OpenNebula SAML integration module matured enough to review it!

As I promised, it has less software dependency, the actual version can work with any SAML authentication system, but we recommend to use it with Shibboleth [1]. The configuration with Shibboleth is easy, you can configure the behaviour of the authentication in sunstone-server.conf, see below. The patch can be applied by just running a short install script, or if you want I can create a patch file for it. This module is for OpenNebula 4.4, but we can easily update it for higher versions of OpenNebula (just a few ERB file have to be modified). We mofified only a limited set of orignial OpenNebula source code (5-10 lines of code).

Some more info:

Description
This is a new authentication module for OpenNebula Sunstone. Shib Cloud Auth module is useful, when a SingleSignOn login is needed, where the Service Provider realised with a Shibboleth SP.
In this case, login handled by Shibboleth and so the Sunstone auth module (this one) controls the authorization of the users.
If a new user wants to login, this module creates a new account for the user. The user's primary group and his secondary groups also created from the entitlements that come to Shibboleth in a SAML message.

Configuration
Configuration file is at the end of the main Sunstone configuration file (see sunstone-server.conf).
Some configuration option is self-descriping (like :shib_host, :shib_logoutpage, :one_auth_for_shib). The rest of the options modify the behaviour of this authentication module.
First an Apache HTTP VirtualHost location have to be created, a possible example can be see here:
<Location /one> # shibboleth shield
AllowOverride all
Order allow,deny
Allow from all
AuthType shibboleth
require valid-use
ShibUseHeaders On
ShibRequireSession On
</Location>

When OpenNebula authorizes a user this module uses some Apache HTTP header variable, where the SAML message datas are stored. After a successful authentication from the Apache HTTP header variables this module can read the actual datas of the user.
Example:
:shib_username: HTTP_EPPN
:shib_entitlement: HTTP_ENTITLEMENT
:shib_entitlement_priority:
- admin
- alpha
- bravo

In the example above the name of the user are stored in the HTTP_EPPN header variable, and the entitlements / privileges are stored in the HTTP_ENTITLEMENT header variable. The primary group of the user is calculated from the shib_entitlement_priority list, where the first existing groupname will be his primary group.

If you have any ideas to improve the module or modify it to be able to get merged into OpenNebula mainstream, get in touch with us!

[1] https://shibboleth.net/

#11 Updated by Milán Unicsovics over 6 years ago

I attached the source of the authentication module.

#12 Updated by Ruben S. Montero about 6 years ago

  • Target version deleted (Release 4.8)

#13 Updated by Daniel Molina about 6 years ago

  • Assignee deleted (Daniel Molina)

#14 Updated by Daniel Molina about 6 years ago

  • Tracker changed from Feature to Backlog

Also available in: Atom PDF